## Why
Copied table selections became code blocks containing the rendered grid, losing table structure. Stripping trailing whitespace from completed responses also removed Markdown hard breaks and spaces in code.
## What changed
- Reconstruct Markdown tables from selected cells across grid and record layouts, preserving alignment, inline formatting, and list or blockquote nesting.
- Copy a single selected cell as inline content and leave unselected cells empty without adding their text. Escape literal pipes in table code spans and link destinations.
- Preserve trailing whitespace on lines unchanged by assistant directive removal.
- Keep blank rows in copied text without painting newline selection highlights on empty rows.
## Testing
Add regression coverage for wrapped and rewrapped tables, partial selections, empty cells, literal pipes, and separate table and code blocks. Update snapshots for nested tables and selection highlights, and verify completed-response copying preserves hard breaks and code whitespace.
GitOrigin-RevId: 661e4c8331f2737bedff286548f9343bac44e0cb
- Show a compact session header with a randomly selected greeting, preserving the greeting and blossom state from startup into the live session.
- Center a settled blossom in unused fullscreen space and replay its animation on click. Hide it while typing or when space is insufficient, and respect `tui.animations` and `tui.effects.welcome`.
- Hide startup tips in the fullscreen transcript while retaining them in terminal scrollback, and prevent hidden entries from shifting the first visible header.
- Keep the composer visible and responsive during daemon startup, routing startup diagnostics through tracing while direct lifecycle commands retain stderr output.
Add regression tests and update snapshots for blossom placement and click replay, welcome opt-outs, greeting stability, startup transitions, tip visibility, and transcript spacing.
GitOrigin-RevId: ec7b082fbe25ced1180cad3348f5c76e48c0e92b
(cherry picked from commit 7f6c0f9387)
- Show a random tip beneath the working status after 30 seconds, using the existing tooltip catalog and current key bindings.
- Show completion tips only after successful turns with a final answer, starting with the third turn and spacing displayed tips by at least three turn starts. Limit completion tips to two per app session, and skip them when a working tip was already shown for that turn.
- Respect `tui.show_tooltips`, hide tips during composer or transcript interactions, and omit tips when space is insufficient. Count exposure only when a tip is rendered.
- Anchor completion tips after queued history updates, keep them outside transcript selection and search, and dismiss them on history replay or transcript clearing.
Add lifecycle tests for timing, completion cadence, duplicate notifications, failed and interrupted turns, and hidden tips. Add rendering snapshots and assertions for completion ordering, resizing, limited terminal space, and exclusion from transcript selection and search.
GitOrigin-RevId: 9e956f5b0377e3be71f9574639c3c6ef11ad1168
(cherry picked from commit ca41ed337f)
## Why
Windows launchers such as `cargo run` can prevent background processes from outliving them, causing automatic daemon startup to fail and blocking the CLI from opening.
## What changed
- Classify detached launch restrictions by retrying an access-denied launch probe without the job breakaway flag. Keep both probes suspended and terminate and reap successful probes.
- Use the embedded server with a visible warning when automatic startup encounters this restriction. Preserve errors for other launch failures, including inaccessible executables and elevated startup.
- Keep explicit daemon lifecycle operations failing on the restriction, with guidance to build and run `codex.exe` directly.
## Testing
Add Windows coverage for restriction classification and executable access failures, plus a CLI integration test and warning snapshot for embedded fallback under a restrictive job. The integration test also checks that elevated startup still fails and no daemon PID file is created.
GitOrigin-RevId: fc7c46e0f5f07ca0aba12b535a0e372021bdf46a
(cherry picked from commit a6bd19261c)
## Why
Piped child processes launched from a detached Windows process should not allocate a console window.
## What changed
Set `CREATE_NO_WINDOW` by default for `codex-rs/utils/pty` child commands. Preserve it alongside `CREATE_SUSPENDED` when preparing a child for Job Object containment, since Tokio's `creation_flags` replaces existing flags.
## Testing
Add a Windows regression test that runs from a detached process and verifies that children have no console window and retain working piped stdin and stdout, both with and without Job Object containment.
GitOrigin-RevId: 990386032d74fa783a66bb20faff769539ea41c1
(cherry picked from commit 1a89aec960)
## What changed
Make `tui.copy_on_select = "auto"` copy on mouse release unless a direct terminal is known to forward its native copy shortcut: Ghostty with a parsed version at least `1.2.0`, Kitty on macOS, Windows Terminal, or VS Code on Windows.
Unknown terminals and Ghostty with older, missing, or unrecognized versions now default to copying. Keep copying enabled under tmux/Zellij and preserve explicit `always` and `never` overrides. Update the configuration documentation and schema to describe these defaults.
## Testing
Expand the existing configuration test matrix to cover more terminals, Ghostty versions (including `1.2.0-dev`), platform-specific defaults, and multiplexer behavior alongside configuration and launch overrides.
GitOrigin-RevId: 410abfa580156454b0f88e0bf4ed977fb8c81b1e
(cherry picked from commit b334d5b3f2)
## What changed
- Add `tui.right_click_paste` with `auto`, `on`, and `off` modes. The default `auto` enables the fallback on Windows and Linux, including WSL when terminal detection is conclusive. `on` also enables macOS. Both modes skip SSH sessions and recognized VS Code terminals.
- Paste clipboard text through the normal composer input path when no selection, search, or blocking view takes precedence. Discard pending results after intervening input, focus loss, or changes to the target thread, draft, or cursor.
- Read text asynchronously through the shared clipboard worker, with a five-second deadline and the message size limit. Read the Windows clipboard through PowerShell on WSL and reject overlapping clipboard operations.
## Testing
Add coverage for platform and terminal policy, normal paste delivery, stale reads, overlapping clipboard operations, read timeouts, oversized text, and large command output.
GitOrigin-RevId: 0a7b6d445c09928da6c5335841ba2a9a66cc7e4b
## Why
Transcript selections were copied as plain text, losing the formatting of rendered Markdown when pasted.
## What changed
- Retain semantic Markdown annotations through rendering, wrapping, and streaming, then serialize selected text with balanced markup.
- Preserve inline formatting, web links, headings, lists, blockquotes, and hard breaks in Markdown clipboard payloads.
- Keep code-only and other literal-only selections as plain text. In mixed selections, escape user prose and fence code, tables, and tool output to preserve their literal content.
## Testing
Add unit tests and Markdown/HTML snapshots covering partial selections, nested containers, escaping, links, resize stability, and streaming boundaries.
GitOrigin-RevId: f0476334a6bf8ad0fb57626627bd258443540852
## Why
TUI test helpers used `TempDir::keep()`, leaving temporary Codex homes on disk after fixtures were dropped.
## What changed
Retain `TempDir` ownership in widget and app fixtures so their homes are removed on drop. Transfer ownership to app fixtures to keep the home alive across widget replacement, and retain directory guards in tests that use configs directly.
## Testing
Add regression tests for recursive cleanup, isolation between widget homes, and app home survival across widget replacement followed by cleanup on app drop.
GitOrigin-RevId: fe80f982cc467ede4c3e1edbac8012ec3066dfb3
## Why
Native clipboard setup and writes can block, preventing the TUI from processing input or closing overlays while a copy is in progress.
## What changed
- Route clipboard copies through one session worker that retains native clipboard ownership. Keep terminal escape output on the UI thread.
- Show pending and busy status messages, reject additional copies without queuing them, and ask users to retry image paste after an active copy finishes.
- Abandon setup after five seconds and prevent late delivery. Keep the worker busy until the blocked call returns, and bound shutdown waiting for clipboard handoff.
- Match completions to their originating requests so stale results cannot clear newer selections or unexpectedly resume transcript following. Retain selections on automatic copies, failures, and unconfirmed delivery.
## Testing
Add regression tests for blocked backends, overlay exit, copy and paste ordering, setup expiry, bounded shutdown, completion status messages, and preservation of replaced or moved selections.
GitOrigin-RevId: 4ba1f8da258b9d0700b0edec9ac0ba699f536785
## What changed
- Add `tui.copy_on_select` with `auto` (default), `always`, and `never` modes, and apply it to the fullscreen transcript, transcript overlay, and resume/fork previews.
- Enable `auto` in tmux and Zellij, and in direct macOS terminals except Ghostty and Kitty. On other platforms, enable it in direct terminals identified as iTerm2 or Terminal.app.
- Copy nonempty mouse selections on release, including word and line selections, while retaining their highlight. Preserve link activation and ignore empty selections.
- Clear composer selections after confirmed keyboard copies, matching right-click copies, while preserving the draft and cursor. Keep selections when copying fails or delivery is unconfirmed.
## Testing
Add coverage for terminal defaults and configuration overrides, copying on release, retained highlights, repeated clicks, link activation, and empty drags. Extend composer coverage to verify selection clearing for `Cmd-C`, `Ctrl-C`, and right-click across clipboard outcomes.
GitOrigin-RevId: 24e6f9e267ef3ab249c5356db736e094127f68b8
## What changed
- Detect Terminal.app from primary and secondary device attributes during startup on Unix SSH sessions without a detected multiplexer. Ignore signatures inside bracketed paste and leave incomplete replies unknown.
- Use inline mode when Terminal.app is detected and `tui.alternate_screen` is `auto`. Apply the decision before the first startup frame and retain it for later configuration loads. Preserve explicit `always`, `never`, and `--no-alt-screen` overrides.
- Update the `crossterm` dependency revision and lockfiles.
## Testing
Add coverage for terminal signatures, fragmented and pasted replies, probe completion and timeout behavior, screen-mode overrides, and an inline startup snapshot.
GitOrigin-RevId: 9b937824b080f9bd6de29df1d9e84f42a698af46
## Why
Codex could enable mouse capture even when the containing tmux session had mouse support turned off.
## What changed
- Probe tmux's `mouse` and `extended-keys-format` settings together, targeting `TMUX_PANE` when available.
- Suppress mouse capture when tmux explicitly reports `0` or `off`, and apply that policy across fullscreen and overlay input changes. Refresh the policy when entering or restoring the alternate screen.
- Preserve normal mouse behavior when the probe fails or the setting is unknown, and retain the keyboard-format fallback for older tmux versions.
## Testing
Add tests for pane targeting, explicit and unknown mouse settings, probe failures, keyboard fallback, and mouse-policy changes across fullscreen and overlays.
GitOrigin-RevId: 7bdd2759207b30a3877e983b489462de7c96e692
## Why
Selecting text can pause following while the final transcript row remains visible. Clearing that selection could leave an unnecessary `esc latest` hint in place of the composer hints.
## What changed
Only show the return-to-latest footer for paused navigation when the transcript tail is out of view. At the bottom, show selection shortcuts without the earlier-history status, then restore composer hints when the selection is cleared, even if following remains paused. Preserve loading and retry hints.
## Testing
Add regression coverage for selection, clicking away, and scrolling at the bottom with partial and complete history, plus selection above the bottom. Verify retry hints with selected text and update activity expectations and the composer-gap snapshot.
GitOrigin-RevId: aeb2109244d6c3214c945abb51cf469087d03074
## Why
User prompt URLs only received explicit hyperlink destinations when they required forced wrapping, leaving other URLs without those annotations.
## What changed
Annotate web URLs before wrapping user messages so their full destinations survive both adaptive wrapping and forced splitting of oversized URLs.
## Testing
Add a regression test and snapshot at widths of 120, 60, and 24 columns, checking URL destinations, line width limits, and matching display and transcript output, including a prompt with an image placeholder and a parenthesized URL.
GitOrigin-RevId: fccae7b76a3613776d7a663c41e699ebad7eebc1
## What changed
Reserve a blank row below a trailing recap when the transcript viewport has room. Keep this spacing in layout rather than selectable content, and omit it when a completed or live message follows the recap.
## Testing
Add snapshots covering recap tail spacing across terminal sizes, with and without a next action, and with completed or streaming follow-up messages. Verify that reflowed history retains a single separator between a recap and the following message.
GitOrigin-RevId: f9552931fac4eabd7d72c2b312ffba717257e9e1
## What changed
- Add “Inspect activity” to the shortcut help’s Session section, using the runtime `focus_activity` binding (`F4` by default) and hiding it when unbound.
- Remove the passive activity footer hint so composer hints remain available. Keep previous, next, details, and back controls while activity is focused, shortening them to fit the available width.
## Testing
Add snapshot coverage for default, remapped, and disabled activity shortcuts. Update footer coverage to verify the absence of passive hints and interactive controls at 20, 32, and 80 columns.
GitOrigin-RevId: 52ca6f4992778cd3cf3eebe163d533e69a8dabeb
## Why
An empty composer hint row already separates activity from the input. Adding another separator wastes transcript space, especially in short terminals.
## What changed
Reserve the extra separator only when copy status text, a follow control, or a fitting hint occupies the shared row and the viewport has room. Recalculate the transcript layout in the same frame when adding that separator, and use a shared timestamp for copy status visibility and expiry.
## Testing
Extend snapshots for running turns with no hint, follow controls in short terminals, and copy status text at narrow widths and limited heights. Update resize assertions to check that the draft and caret remain stable relative to the terminal bottom.
GitOrigin-RevId: a73894063b759ec6b9a25f720e0e8007516109c8
## Why
Conversations open in another app disable the composer. Let users continue in an editable fork while the original conversation remains owned by that app.
## What changed
- Add an `f`/`F` shortcut and footer hint to the locked conversation view, preserving local drafts and queued prompts in the fork.
- Show “Forking conversation…” while a fork is pending, block additional key input, and discard buffered input after forking from the locked view.
- Replace the previous session summary after a fork with “Fork created. You can continue here.”
- Keep the locked view and draft intact if the fork request fails.
## Testing
Add tests for shortcut ownership and modifiers, repeated input, editable forks that preserve drafts and queued prompts without taking the source lease, and failure recovery. Add snapshots for fork progress, completion, and the updated footer.
GitOrigin-RevId: 2ecdb0b7fc7e82d8295097faa567995d7a2f7d92
Change `R to Retry` to `r to retry` in the TUI notice and update the
corresponding rendering snapshots.
GitOrigin-RevId: f7971ba0f76ac446a5fea53b44390f65aa965be4
## Why
Activity indicators and queued input previews could separate usage notices and
reading controls from the composer.
## What changed
- Reserve the shared hint row below activity and previews in the owned transcript
layout, and use its rendered position for hints and reading controls.
- Clip spacing and hints before activity and previews when vertical space is tight.
- Fit usage notice details within half the row, allowing the shortest complete
warning to use more space on narrow terminals.
## Testing
Expand regression tests and snapshots for running turns, queued inputs, multiline
drafts, short terminals, follow-control clicks, and hidden actionable banners.
Cover five-hour and weekly usage notice width thresholds.
GitOrigin-RevId: e73b3614839ce35c5b0a009901514627a77d4190
## Why
Chat analytics displayed raw credit strings, exposing values such as `0E-10` for plan-covered tasks and unnecessary trailing decimal zeros.
## What changed
Format ordinary credit amounts with two decimal places and thousands separators. Round directly from decimal digits to avoid floating-point rounding errors, so `1.005` becomes `1.01`. Normalize zero to `0.00`, while preserving the original strings for nonzero sub-cent amounts and values outside the safe conversion range.
## Testing
Add assertions for decimal and scientific notation, signed zero, rounding boundaries, tiny adjustments, and large values. Update the chat analytics snapshot to cover a plan-covered task showing `0.00` credits.
GitOrigin-RevId: f946cb408c2c37291447f90de02ebbb557fbc662
## Why
Quota warnings were hidden from normal transcript rendering, leaving no persistent reminder of remaining usage near the composer.
## What changed
- Show the most constrained quota window in the existing composer hint row, using the existing plan-specific warning thresholds. Include remaining usage, reset time, and `/status` when space permits.
- Keep the notice visible while typing or running a turn, even with tooltips disabled. Yield to interaction controls and blocking banners, and suppress the notice when usable credits are available.
- Preserve quota metadata across sparse updates and thread switches. Require a fresh account usage read to confirm recovery, ignore reads made stale by newer rolling updates, and clear notice state on account changes.
- Render quota warning history cells in both transcript modes while retaining warning counts and replay deduplication.
## Testing
Add unit, integration, and snapshot coverage for warning thresholds, narrow layouts, unchanged composer geometry, suppression, recovery, overlapping reads, account changes, and native transcript replay.
GitOrigin-RevId: e45dc94a6e7a9dad50307840b9fdb15978d053dc
## Why
Pausing transcript following can leave the current final row visible, making the “Back to bottom” control unnecessary after copying text, closing find, or enlarging the viewport.
## What changed
Base control visibility on whether the current transcript tail is visible, and hide it for an empty viewport. Keep the control available when a paused view shows an older live revision with new activity.
## Testing
Add regression coverage for empty viewports, copying at the bottom, closing find at the bottom, and resizing a paused view. Extend live-revision assertions and update the composer-gap snapshot to keep the gap blank in the paused detailed view at the tail.
GitOrigin-RevId: d33b4279f5f5f43ae76c34466c18e89b61ad766c
## Why
Adding blank lines only after multiline items gives lists uneven spacing. Completed lists in redrawable transcript views can use consistent spacing based on their rendered width.
## What changed
- Keep assistant and plan lists compact while streaming in the fullscreen transcript, without holding back completed list rows.
- On completion or interruption, separate all sibling items if any item spans multiple rows; keep single-line lists compact and recompute spacing on resize.
- Preserve the reader's displayed content when consolidating streamed cells, and include spacing policy in the Markdown render cache key.
- Retain existing list spacing for native terminal scrollback.
## Testing
Add regression and snapshot coverage for streaming completion and interruption, width-dependent reflow, reader position, nested and quoted lists, item paragraphs, and preservation of links and source metadata.
GitOrigin-RevId: b2230aaf76ae798ebb6bf15563f8b8dcb6f3d19d
## What changed
Allow right-clicking inside the transcript or composer to copy its selected text using the existing clipboard status messages. Clear the selection only when the right-click copy is confirmed; retain it after failed or unconfirmed copies. Keyboard copies continue to retain composer selections.
Preserve the draft, cursor, and transcript reading position. Refresh composer layout before checking mouse coordinates, and respect modal and transcript input ownership.
## Testing
Add regression tests and snapshots covering copy outcomes, selection retention, reading position, editor bounds after layout changes, and input ownership.
GitOrigin-RevId: 322b303394378a20b2a25b3d218777c9ea65c92b
## What changed
Add a picker for Scrollback and Fullscreen modes that requires explicit
confirmation and saves `tui.fullscreen_transcript` to the selected user config
file. Keep the running renderer unchanged and explain that a restart is required
and launch overrides still apply. Report save failures without changing the
stored preference in memory.
## Testing
Add picker snapshots and tests for confirmation, cancellation, selected-config
persistence, and failed saves. Add a PTY test covering mode changes in both
directions across restarts while verifying that the current session stays in
its original mode.
GitOrigin-RevId: 7f231ab37c89e2168133fcfd6aaee54775aa7972
## Why
Subagent activity can arrive while the parent answer is still streaming. Rendering it immediately flushes the answer stream before the authoritative message completes.
## What changed
- Defer subagent activity until the answer stream finishes, preserving one complete answer before the activity row.
- Drain queued lifecycle activity when a turn ends without opening queued prompts.
- Show late subagent activity after the turn stops even when unresolved prompts remain queued.
## Testing
Add regression coverage for completion before or between answer deltas, a missing final delta, interrupted and failed turns, and late activity with queued questions. Extend dynamic activity coverage to verify that turn finalization leaves queued prompts unopened.
GitOrigin-RevId: f0577b9ac47cf652c7c75b3aace38c10dccada18
## What changed
- Expose `analytics_plan_history` in the experimental features menu for previewing consumer five-hour and weekly allowance history in `/analytics`. Keep it disabled by default.
- Add `h` and `l` as left/right navigation aliases in analytics, preserving explicit bindings and honoring remapped or unbound arrows.
- Use terminal-aware footer key colors to keep analytics shortcuts readable on light backgrounds.
## Testing
Add navigation tests for arrow equivalence, custom bindings, modifiers, and key repeat. Extend light-background contrast assertions and update style snapshots. Add a snapshot for the plan history experimental feature entry.
GitOrigin-RevId: 310e64a43a7dd08c8a3fd1efed6985805f7dd580
## Why
Reading daily totals required selecting each bar, and changing grouping required opening a picker. Section navigation could shift vertically, while scroll hints appeared even when content fit.
## What changed
- Make `g` cycle through available groupings and summary views directly.
- Show daily totals on charts spanning up to seven days when space permits, prioritizing the selected value and keeping neighboring labels separate.
- Keep section navigation at a stable height, show more legend rows in taller maximized reports, and move their update timestamp into the footer.
- Hide scroll hints when content fits, including an exact fit, and show only the active summary view label.
## Testing
Add regression tests and snapshots for seven-day totals, narrow label spacing, grouping wraparound and server capabilities, configured `g` navigation in ungrouped sections, stable tab placement, adaptive legends, footer timestamps, and overflow-dependent scroll hints.
GitOrigin-RevId: 9d14f314b4a22ca2d926f0e69c6b89e4f9c8550d
## What changed
- Make Summary the initial Analytics tab, showing profile identity, token totals, streaks, activity insights, and most-used plugins and skills.
- Move daily, weekly, and cumulative token activity charts into Summary. Replace the usage menu's separate views with “View analytics”; `/usage weekly` and the other explicit modes open Summary with the requested view, while reopening from the menu retains navigation.
- Load account profiles independently of other reports, preserve missing values separately from zero, and reject responses when the active account changes. Refresh retries profile failures.
- Adapt Summary to narrow terminals and compact large chart totals and axis labels. Show the account email without its ID in the Analytics header.
- Flush queued transcript history before opening an overlay so startup output stays in the transcript.
## Testing
Add profile decoding and account identity tests, Summary layout and navigation snapshots, refresh and cancellation coverage, and regression tests for retained navigation and transcript history when opening Analytics.
GitOrigin-RevId: 6dbe6c4c98209000d8b4bc18a4e01b98fab5991a
## Why
Consumer analytics lacked a per-chat view of allowance usage and balance credit debits.
## What changed
- Add a Top chats panel for up to 100 local chats active in the past 30 days, including discovered descendants and excluding archived roots.
- Show weekly and five-hour usage as percentages of current full limits, plus balance credits including adjustments. Preserve exact credit decimals and distinguish missing values from zero.
- Support cycling sort metrics with `s`, a top-five dashboard summary, and expandable model, reasoning effort, and speed breakdowns.
- Query task usage through `query_v2` with bounded, disjoint descendant groups. Retain partial and unavailable rows, hide titles when usage is unavailable, and report ranking coverage and freshness.
## Testing
Add backend and TUI tests covering decimal precision, request and response validation, paginated archived descendants, unavailable responses, metric selection, title hiding, and top-five rendering.
GitOrigin-RevId: b8f233166576389c8212bb97eceb7c6be7f5f51d
## What changed
- Add consumer plan usage history behind `analytics_plan_history`, disabled by default, fetching seven days of five-hour and weekly allowance periods.
- Show period usage percentages with expandable breakdowns by feature, model, surface, or turn start, plus snapshot freshness and incomplete coverage indicators.
- Preserve unknown usage separately from zero and handle an unavailable history endpoint without blocking other analytics reports.
## Testing
Add backend and TUI tests for unavailable endpoints, response validation, feature and account gating, account changes during requests, period navigation, snapshot resets, and narrow and wide layouts.
GitOrigin-RevId: 7bea87a3407730b18040d7dda7e7dd0afe67fb2e
## What changed
- Show local chats active in the past 30 days, ranked by estimated lifetime credits, for supported Business and Enterprise plans. Exclude archived chats and subagents.
- Add expandable model, reasoning effort, and speed breakdowns, optional zero-credit groups, and dollar estimates when supplied by the backend.
- Load estimates in bounded batches of up to 100 distinct threads, retaining available results when some estimates are unavailable. Hide chat titles without a returned estimate and distinguish missing usage from zero.
## Testing
Add coverage for batch validation, partial failures, request limits, pagination and ranking, plan eligibility, title visibility, and responsive table navigation and details.
GitOrigin-RevId: 783b960a780f4e0fd39f57e2fa78fb31b3090c44
## What changed
- Add “Explore analytics” to the `/usage` menu for ChatGPT accounts, opening a full-screen dashboard.
- Show usage and messages for consumer accounts, credits and token usage for Business and Enterprise accounts, and plugin and skill activity for both.
- Support overview and maximized views, 7- and 30-day ranges, report grouping, daily details, model filtering for token usage, and refresh.
- Keep report loading and errors independent, cancel pending loads on close, and retain navigation state across reopening while preserving the composer draft.
## Testing
Add regression and snapshot coverage for account-specific reports, range and grouping changes, model filtering, loading and cancellation, small terminals, terminal colors, and draft preservation.
GitOrigin-RevId: 46da94a14d6e227551e740b85f9d2d552aaf75b0
## What changed
Add daily stacked bar rendering in the TUI analytics module, staged for dashboard integration.
- Plot three categories plus an Other remainder without renormalizing values, with separate positive and negative bands for signed credits.
- Add readable numeric axes, calendar ticks, a selection cursor, and a callout showing the authoritative daily total. Distinguish missing days from zero usage.
- Keep the selection visible in narrow viewports and omit labels that cannot fit without truncation.
- Use terminal palette colors for series and adapt secondary text to terminal color support and background.
## Testing
Add unit and snapshot coverage for axis scaling, signed bars on light and dark terminals, missing and zero values, narrow layouts, tiny segments, authoritative totals, and duplicate-date remainders.
GitOrigin-RevId: 2ed58def17abd14e77929016a54fd20e91d45670
## Why
Token plan claims can be stale, and the active account or user can change while a request is in flight. Analytics report selection and account-bound response data need to reflect the verified identity and current server plan.
## What changed
- Fetch the active account's plan once per analytics session and use it to select report endpoints and supported credit breakdowns.
- Add report loading with a fixed end date, account-scoped response caching, and token model filtering. Reuse payloads across grouping changes and evict invalid cached responses so requests can retry.
- Prefer complete attribution for usage breakdowns within the requested range; retain legacy surface/model data when attribution is incomplete and include all features in turn-start breakdowns.
- Add cancellable report-loading state with timeout and interruption errors, and preserve actionable sign-in and retry messages.
- Recheck the active identity after rate-limit reads before exposing account-bound fields.
## Testing
Add regression tests for server plan discovery, report routing and caching, model filtering, attribution fallback, failed-request retries, load cancellation, authentication recovery, and account or user changes during requests.
GitOrigin-RevId: 45c4c09f108c9703893f3ed15613437ebd7c74a8
## What changed
- Add `AnalyticsSession` to load local ChatGPT credentials, bind requests to the initial account and user, and reject identity changes before requests or when accepting results.
- Reload credentials and provide bounded recovery for unauthorized requests, using a backend client that disables redirects.
- Add lazy TUI analytics session initialization, account display metadata, and plan-specific credit groupings for future dashboard integration.
## Testing
Add regression tests for account and user changes, missing or API-key-only authentication, credential reloads, recovery after a `401` response, and session initialization after signing in.
GitOrigin-RevId: 2ba0d96fb44936d12d13aedffc3f2e61aedea560
## What changed
- Add daily text token history grouped by model or token type, with date-range and model filtering, freshness metadata, and validation of token counts. Support both grouped and per-model report data, including reported model totals when components are unavailable.
- Add credit formatting helpers that preserve tiny signed adjustments and format integer millionths without floating-point rounding, plus a short date formatter.
## Testing
Add unit tests for token groupings, model filtering, freshness, missing components, explicit zero totals, and credit formatting across tiny refunds and integer limits.
GitOrigin-RevId: 706dcae7995e46707c2f1df9cdf3e06966459dd6
## What changed
Add display models and adapters from typed backend responses for usage, credits, messages, plugins, and skills. Normalize reports into daily histories with grouping labels, units, and freshness timestamps.
Preserve missing values, signed credit adjustments, and full daily totals when grouping usage by task start. Account for unassigned message counts as `Other`, merge duplicate dates, and fill unreported days only for credit reports. Group models contributing less than 1% of relative usage into `Other`.
This adds the data preparation layer for dashboard integration; it is not yet connected to `/usage`.
## Testing
Add unit tests covering missing versus explicit zero values, signed credits, enterprise labels and freshness, usage grouping, duplicate-date message remainders, and unsupported message groupings.
GitOrigin-RevId: 931f46a9a6521b4cda2fc26051e7a305cbf6fa6c
## What changed
Add `Client::get_account_analytics` with public `AnalyticsReport`, `AnalyticsResponse`, and analytics models for token usage, credits, workspace messages, plugins, and skills. Select report-specific routes and query parameters for both `api/codex` and `wham` paths.
Preserve backend attribution, optional amounts, and signed credit values. Keep string values open for forward compatibility, and return a generic decoding error without including the response body.
## Testing
Add HTTP contract tests covering report routing and decoding, plugin query parameters, signed credit events, new string values, and rejection of mismatched response shapes without exposing the body in the error.
GitOrigin-RevId: 196ff7f49c3f9d8a029398d09af14449c5d04207
## Why
A persistent tmux session can gain remote clients after Codex starts, so successful native copying must not skip terminal forwarding. Terminal sends also lack delivery acknowledgement and cannot replace native copying reliably.
## What changed
- Attempt native copying first, then independently forward through tmux or OSC 52 in tmux and SSH sessions. Preserve existing native clipboard leases when a later copy returns no new lease.
- Target the most recently active client in the current pane's tmux session, checking that client's clipboard capability before sending. Retain OSC 52 fallback when tmux forwarding fails.
- Reject empty selections without touching clipboards and apply the 100,000-byte terminal payload limit to tmux copies.
- Resolve tmux and PowerShell through trusted system locations, adding Nix system profiles and the WSL PowerShell directory to helper discovery.
## Testing
Add regression coverage for native-before-terminal ordering, fallback routing, clipboard lease retention, empty and oversized payloads, tmux client selection, capability checks, and combined backend errors.
GitOrigin-RevId: df4b66fa4368a3cf19b4d07fde6c76ea96a8fef5
## Why
Scrolling with `CSI S` can discard history rows in QTermWidget and xterm.js when the viewport grows.
## What changed
Use newlines at the bottom of the history scroll region for `ScrollbackStrategy::Standard`, preserving the composer and restoring the cursor and full-screen scroll region afterward. Fall back to full-screen scrolling when only one history row exists, since `DECSTBM` requires two distinct rows. Skip scrolling when there are no history rows or no rows to scroll.
## Testing
Add regression tests for composer and cursor preservation, scroll-region restoration, emitted newline sequences, single-row scrollback preservation, and no-op growth. Snapshot visible geometry for growth by one, three, and four rows.
GitOrigin-RevId: 1dbfc30bb6997dcc2738ec6b2f42d35c786124de
## What changed
Remove the animated stars shown when selecting Astra, along with their input, terminal-focus, and model-selection hooks.
## Testing
Retain draft text and live voice control snapshots in a standalone composer snapshot test, and remove sparkle-specific tests and snapshots.
GitOrigin-RevId: cbe4396e8700cabfb1e0db9fbe8f997b94316c0f
## Why
Saving a manual thread name leaves pending title generation running and its progress indicator visible until the request finishes.
## What changed
- Cancel pending title requests after a successful manual rename, including renames from the agents overview, and clear the progress indicator immediately.
- Interrupt canceled title-generation turns and unsubscribe their temporary threads. Ignore late start and completion events so canceled requests cannot affect newer requests.
- Cancel pending title requests when resetting connection state.
- Show only a spinner when generating a title without an existing name, removing the `renaming...` placeholder.
## Testing
Add regression tests for manual and overview renames that verify turn interruption, cleanup, and preservation of the saved name. Cover late events after cancellation and update footer and terminal-title snapshots for the spinner-only display.
GitOrigin-RevId: f9490ea7be9968ea6c35d80bfbac06fee57d0135
## Why
The 900-byte recap prompt limit leaves little room for completed progress, unresolved caveats, and recent corrections. Recaps need this context to distinguish completed work from pending requests.
## What changed
- Introduce a shared `RecapPrompt` with a 32 KiB ceiling for instructions and history, using an 8,192-token estimate. Instruct summaries to retain the broader goal, completed outcomes, and unresolved availability or validation caveats.
- Select up to eight answered exchanges plus a pending request, preserving adjacent steering and progress messages. Drop older whole exchanges before excerpting both ends of oversized messages, while retaining the newest answer and pending correction.
- Require a `summary` and nullable `next_action`, bounded to 700 and 200 characters respectively. Reject malformed or oversized responses and display an optional, separately styled `Next:` line.
## Testing
Add coverage for UTF-8 prompt bounds, exchange selection, pending corrections, excerpt boundaries, strict response parsing, and next-action rendering. Extend the recap generation integration test to verify bounded history and the structured response schema.
GitOrigin-RevId: 6c6a84bc602a168418c1952feb1d286ec0cb9e28
## What changed
- Increase the automatic recap delay from 3 to 30 minutes.
- Replace the recap heading and divider with an italic `↳ Recap:` layout, hanging indentation, and right padding. Preserve explicit line breaks and Unicode, splitting URLs only when they exceed the available text column.
- Use Tokio's clock for automatic recap eligibility and create the timer before spawning its task.
- Remove the `token_budget.use_history_notes_extension` override from temporary structured requests.
## Testing
Add coverage for the 30-minute deadline, recap styling, narrow terminals, Unicode, and URL wrapping. Update recap generation and reconnect tests to advance Tokio's clock instead of relying on host uptime.
GitOrigin-RevId: 79a9bca779020b59a409207163b02944b30c1a20
## What changed
- Update the status heading from the latest usable reasoning line and retain it through tool activity and empty reasoning items. Keep completed reasoning in the expanded transcript only.
- Restore active reasoning after resume, thread switches, and session refreshes, including when earlier events have left the replay buffer.
- Default new embedded TUI threads to `model_reasoning_summary = "detailed"`, honoring explicit summary settings. Keep `concurrent_reasoning_summaries` opt-in and disable it when summaries are `none`.
- Persist the request's captured reasoning summary setting in context updates and local and remote compaction checkpoints.
- Animate status text with a smooth, grapheme-aware shimmer that respects terminal colors and reduced motion.
## Testing
Add regression coverage for reasoning status updates, transcript visibility, resume and buffered replay, outbound summary configuration, and summary settings across all three compaction modes. Add shimmer snapshots and checks for smooth brightness changes and Unicode grapheme preservation.
GitOrigin-RevId: 725c7de20f23166d7a3da6daeca617add5cbc600
## Why
Lost tmux resize notifications can leave the TUI using stale terminal dimensions.
## What changed
Add a background size monitor for tmux on Unix that checks terminal dimensions every 500 ms and delivers detected changes as resize events. Queries run off the UI thread so a slow query does not block input.
Pause monitoring during terminal handoffs and discard samples invalidated by newer geometry or pause/resume transitions. Ignore unchanged, invalid, or failed samples, and stop monitoring without waiting for a blocked query.
## Testing
Add tests for missed-resize recovery and text wrapping, input responsiveness during blocked queries, stale sample rejection, pause/resume handling, nonblocking shutdown, and tmux-only activation.
GitOrigin-RevId: 461f09bf792f1d9760672dd33b125ecdf0ebd1e0
## What changed
Render adjacent `cua_repl` calls as a compact “Using computer” or “Used computer” group with action and failure counts. Show the current action while running, and prioritize failures and screenshots in completed previews while preserving their chronological order.
Keep full call arguments and output in the expanded transcript, with a `ctrl+t` hint for hidden actions. End groups at other history items and turn boundaries, preserve completed results when pending actions are interrupted, and use the same grouping for live events and history replay.
## Testing
Add unit and snapshot coverage for live/replay parity, grouping boundaries, out-of-order completion, interruption, failure and screenshot previews, full transcript details, and narrow-terminal and Unicode rendering.
GitOrigin-RevId: 8e61ccf4c9f6d1a4d56d674a6d41ca5160d42c82
## What changed
Replace horizontal turn separators with dim completion metadata after the final answer, including plain conversational answers. Show local completion times such as `done 2:32 PM`, adding the date for other days and the year for other years. Retain `Worked for` durations above sixty seconds and runtime metrics, and wrap metadata on narrow terminals.
Restore saved completion metadata when resuming conversations or loading older history. Keep each footer after its turn's items and deduplicate it across repeated notifications and overlapping pages. Only live completions fall back to the current time when a saved timestamp is unavailable. Failed, interrupted, and in-progress turns do not receive success footers.
Avoid submitting queued input or emitting completion notifications while replaying history.
## Testing
Add unit and snapshot coverage for timestamp formatting, duration thresholds, muted styling, narrow layouts, live and replayed completions, missing metadata, and pagination boundaries with overlapping pages.
GitOrigin-RevId: 308c35c6720720da43c9a391aa5a68c1b231c9a5
## Why
Resuming a conversation that is open in another app fails with an active-writer error. Allow users to inspect its transcript and retry after closing it in the other app.
## What changed
- Fall back to a read-only history snapshot on active-writer conflicts during startup and session selection.
- Replace the composer with an explanatory notice, `R` to retry, exit shortcuts, and the configured transcript shortcut.
- Block input and freeze active command and MCP animations while viewing the snapshot. Preserve initial prompts and existing drafts for a successful retry.
- Keep the subscription when retrying the same thread and preserve read-only state across thread switches and reconnects.
## Testing
Add regression tests for conflict detection, history viewing, draft preservation, same-thread retry without unsubscribing, exit shortcuts, and notice and frozen-tool rendering.
GitOrigin-RevId: fa864cc73143cad9139c22e33b7958569eec20cf
## What changed
- Add rendered HTML alongside the original Markdown when copying a whole response through the native clipboard, so rich-text destinations preserve headings, lists, tables, code, and other formatting.
- Keep code-block, blockquote, transcript, terminal, and WSL clipboard copies as plain text.
- Escape raw HTML, omit remote image sources, and render unsupported link destinations as visible text when producing clipboard HTML.
## Testing
- Add coverage for rich formatting, local and unsafe links, inert images, fenced tables, copy selection formats, and clipboard fallbacks.
GitOrigin-RevId: c6f5edd88b65f9e9b1ddc5618442868cf47ee560
## Why
Automatic title generation used a provisional thread name and only applied the
generated result while its thread remained active. Switching threads could
therefore leave the originating thread without its generated name.
## What changed
- Track title-generation requests by thread so results are persisted for the
originating thread, while preserving any name set before generation finishes.
- Show a `renaming...` spinner instead of a provisional name, including across
thread switches and failure paths.
- Add `thread-name` items to the status line and terminal title, and include the
generated thread name in both default layouts.
## Testing
- Cover automatic naming, manual-name precedence, thread switching, failed
requests, deduplication, and status-surface rendering and animation.
GitOrigin-RevId: a03ae4849bedec9f62f256fadad72c1685ce46e0
## Why
Leaving an alternate-screen overlay in inline mode could retain stale overlay
cells and leave conversation history scrolled out of view.
## What changed
- Invalidate the restored inline viewport after leaving the alternate screen so
the next draw repaints it against the main screen.
- Reflow transcript history once when a full-height inline viewport returns to
the shorter chat layout, including transitions not tracked by the agents
overview.
## Testing
Added regression coverage for repainting the restored composer and rebuilding
history exactly once after a full-screen overlay closes.
GitOrigin-RevId: c6d63299fd95731603d8b1d7f04afcd4b92c1681
## Why
Automatic startup work and `codex doctor` can run before a workspace is
trusted. A repository-controlled `PATH` must not be able to make those flows
execute workspace-provided helpers.
## What changed
- Resolve helpers used by automatic startup from trusted system installation
directories, and give plugin-sync Git subprocesses a sanitized environment.
- Make terminal detection environment-only and have doctor inspect executable
locations without running them. Fetch update metadata with the HTTP client
instead of `curl`.
- Fall back conservatively when trusted terminal helpers are unavailable,
including for tmux keyboard enhancement flags.
## Testing
Add black-box coverage with hostile workspace `PATH` entries for startup,
interactive tmux startup, support log collection, doctor, and curated plugin
sync. Add unit coverage for trusted executable resolution and bounded update
HTTP responses.
GitOrigin-RevId: 3b8995eb422b60ed53b0386951de59e8f9bfc542
## Why
Users returning to a conversation need a short summary of its recent progress and next steps.
## What changed
- Generate a recap for eligible idle, unfocused conversations and add it to the transcript.
- Add `/recap` to request the same summary on demand, with visible progress and actionable errors.
- Keep recap requests bounded and isolated, reject stale results, and retry only automatic failures.
## Testing
- Cover automatic and manual generation, request eligibility, failure handling, loading-state cleanup, and temporary-thread configuration.
GitOrigin-RevId: 926a88d6996d67a42809ce2c4091b13fca882b52
## What changed
- Schedule recap eligibility checks when an unfocused thread changes, and cancel them when focus returns or recap state is replaced.
- Add bounded structured recap requests with stale-result rejection, normalized output, and one retry per turn revision.
- Harden temporary structured threads by reading the effective configuration and disabling all discovered MCP servers, tools, skills, and environment access.
## Testing
- Cover recap timers, focus changes, failed turns, output bounds, stale results, and retry behavior.
GitOrigin-RevId: eebf50059763928e9a2444b14d51648e0bdff4a8
## What changed
- Forward terminal focus changes through the TUI event stream and handle them across interactive screens.
- Track completed turns and recap eligibility across active, resumed, and switched threads.
- Add bounded recent-conversation prompt construction and a wrapping `Conversation recap` history cell.
- Cover focus timing, repeat eligibility, restored progress, UTF-8 prompt limits, and recap rendering with unit and snapshot tests.
GitOrigin-RevId: d7542c18b2bb1e72f5906f563898645bb526255f
## Why
Windows Terminal and xterm.js can render a theme that differs from the
underlying console color table. Querying that visible theme through OSC shares
the console input queue with keystrokes, including input for security-sensitive
startup prompts.
## What changed
- Defer the Windows OSC color probe until protected startup decisions and the
world-writable workspace scan have completed.
- Preserve and replay unrelated console input records around the probe, while
removing only valid OSC 10 and 11 replies and retaining the console palette
as a fallback.
- Require an explicit confirmation key after shortcuts select trust, sandbox,
or world-writable warning choices, so a fragmented terminal reply cannot
accept them.
- Accept one- through four-digit OSC RGB components so the visible terminal
palette is applied across supported response formats.
## Testing
Added coverage for delayed startup scans, protected prompt confirmation,
console-record replay, bracketed paste and malformed OSC preservation, RGB
response parsing, and light-theme composer rendering.
GitOrigin-RevId: b8ae456fe32c701ba3af31e9cc452fc4e8bffa22
## What changed
- Generate a title suggestion from the latest substantive user and assistant messages when the TUI `/rename` prompt opens.
- Prefill the prompt with the result while keeping it editable and preserving any text the user enters before generation finishes.
- Bound and escape the conversation context, omit commentary and IDE context, and correlate responses with the active thread and prompt so stale suggestions are ignored.
## Testing
- Cover conversation selection and prompt construction, generated-title delivery through the embedded app server, loading and prefilled prompt states, stale responses, and preservation of manual edits.
GitOrigin-RevId: 1e7f1d5d4f6503ff9da0548388f610c446c130ca
## What changed
- Ignore `thread/started` notifications for ephemeral threads whose feature source is `system`, preventing hidden helper threads from entering TUI thread routing or refreshing the agents overview.
- Continue routing persisted system threads normally.
## Testing
- Add coverage for hidden and persisted system-thread notifications in the agents overview.
- Add generated-title normalization cases for wrapping quotes, trailing punctuation, and meaningful leading punctuation.
GitOrigin-RevId: e1ea48502b4f9aa7d5a187c7407df69c55abe2a9
## What changed
- Give unnamed TUI threads an immediate provisional title from the first user message, then replace it asynchronously with a normalized generated title.
- Preserve manual renames by applying a generated title only while the provisional title is still current, and keep automatic rename notifications out of the transcript.
- Run title generation in a bounded ephemeral structured request that preserves custom permission profiles, otherwise uses read-only access, and disables tools and MCP servers.
## Testing
- Cover prompt and response bounds, Unicode-safe truncation, title normalization, manual-rename races, silent automatic updates, permission preservation, and structured-response failures.
GitOrigin-RevId: 7ed73522f4f6c65a005f65f3a903974d8419e312
## What changed
- Cover live and replayed patch approvals recovering their file changes for the full-screen pager.
- Verify scrolling, resizing, dismissing and reopening the pager, and accepting or canceling a request exactly once.
- Document why approval requests recover diff contents from the matching stored item.
GitOrigin-RevId: 0b1ef25998aa466409ea79731e2c913a6d42388a
## Why
Showing the cursor before moving it can briefly expose it at its previous
position during a draw.
## What changed
Reorder terminal cursor updates so the cursor is positioned before it is made
visible.
## Testing
Add a regression test that verifies the cursor move escape sequence is emitted
before the show-cursor sequence.
GitOrigin-RevId: 2df277ba315bef4a7a56c11ecb78fcd52c354ac5
## Why
Creating the telemetry shutdown thread during shutdown can fail under resource
pressure, including when the native thread guard page cannot be allocated.
## What changed
- Start and verify a dedicated shutdown worker when `OtelProvider` is created.
- Send the provider to the prepared worker for bounded shutdown, while preserving
timeout behavior and avoiding a potentially blocking destructor if worker
preparation failed.
- Rename the fallible provider constructor to `try_new`.
## Testing
Add Unix regression coverage that injects guard-page allocation failures, plus
coverage for worker preparation failure, successful shutdown, and timeouts.
GitOrigin-RevId: 3656298078a800a7fa392437c2ee4a68753092e3
## Why
Terminal autowrap for oversized URL tokens can drop the user-message gutter and background on continuation rows.
## What changed
- Explicitly wrap long URLs within the available message width.
- Preserve the complete OSC 8 hyperlink destination on every wrapped fragment.
- Keep the user-message gutter and background styling across continuation rows.
## Testing
Add history-cell and VT100 coverage for URL content, hyperlink targets, gutters, and backgrounds across wrapped rows.
GitOrigin-RevId: 59514eee4ab967bd937b55574b9f8d0d1c82df7c
## What changed
- Add `thread-credits` and `estimated-thread-cost` items to the configurable
status line and terminal title for Enterprise workspaces.
- Fetch one shared thread usage estimate only when either item is selected,
omit unavailable values, and refresh the display after turns complete.
- Preserve the last nonzero estimate while usage settles, with bounded delayed
refreshes and retries for transient failures.
## Testing
- Add coverage for configuration, rendering, previews, plan availability,
replay handling, retries, and post-turn settlement.
GitOrigin-RevId: dd69ee621c5bca0e5d9edd32b2bba42487eb1500
## What changed
- Extend `account/usage/read` with an optional `threadId` request and a
backward-compatible `threadUsage` response containing estimated credits,
optional USD cost, and model, reasoning, speed, and token breakdowns.
- Fetch thread usage for eligible Business and Enterprise plans when `/status`
is opened, then update the rendered status card asynchronously.
- Preserve terminal scrollback when replacing a visible status-card tail, and
append a refreshed card when the original tail can no longer be updated.
## Testing
- Add app-server coverage for authentication, canonical thread IDs,
unavailable billing routes, and malformed IDs.
- Add TUI coverage for usage formatting, stale responses, retries, history
updates, terminal reflow, and scrollback preservation.
GitOrigin-RevId: 49300914b3fba917c0f08e8595363e04e5ba6d37
## What changed
- Add `Client::get_thread_usage` for querying authoritative estimated credit
and dollar usage for a thread across both supported backend path styles.
- Expose usage totals and optional model, reasoning effort, speed, and token
breakdowns through `ThreadUsage` and `ThreadUsageBreakdownGroup`.
- Reject responses that do not include the requested thread.
## Testing
- Cover endpoint paths, request serialization, complete and partial usage
responses, and mismatched thread IDs.
GitOrigin-RevId: 16c83590b2c804e0182b4493cf2aa39206029c77
## Why
During inline-mode resize reflow, replayed history can overlap a zero- or
one-row history region and leave stale terminal characters visible in the
composer. Resetting the previous render buffer is insufficient because
default-style spaces may still compare equal and be skipped.
## What changed
- Mark every cell in an invalidated viewport for unconditional repainting.
- Invalidate the viewport after flushing pending history when history can
overlap it.
## Testing
Add regression coverage for repainting spaces over stale cells and a manual
`tmux` resize smoke test for preserving visible multiline draft text.
GitOrigin-RevId: 5a8a480e2fc50c801561de6a4598a3ab8c12b8d6
## Why
A stalled telemetry exporter can block shutdown indefinitely when the interactive TUI exits.
## What changed
- Add `OtelProvider::shutdown_with_timeout` to run exporter shutdown on a detached thread and report completion, worker failure, or timeout.
- Give interactive TUI telemetry shutdown a 500 ms time budget and warn if cleanup does not finish successfully.
## Testing
- Cover successful shutdown on current-thread and multi-thread Tokio runtimes, worker creation failure, and timeout behavior.
- Verify that OTLP HTTP shutdown returns on time when a collector stalls.
GitOrigin-RevId: 5b5f31a841fbc5788715cb3065d522c6dafa994f
## What changed
- Keep paginated resume, transcript, and fork workflows on bounded turn and item page requests, while preserving the legacy full-history fallback.
- Refill underfilled terminal scrollback from older pages and show a transcript shortcut when earlier history is unloaded or truncated by the row cap.
- Preserve a successfully created fork if its initial history hydration fails, keep side forks bounded, and retain the correct history boundary for nested forks and subagents.
## Testing
- Add coverage for scrollback refill and truncation notices, bounded paginated requests, fork hydration failures, nested forks, and inherited subagent history filtering.
GitOrigin-RevId: 10ba952ffb2f69717fbc71aa03cac7685f7dcf78
## What changed
- Load older transcript items in bounded pages as users scroll upward, and let `Home` continue fetching until the start of the thread.
- Show loading, partial-history, retry, and complete states in the transcript overlay while preserving the visible scroll position as pages are prepended.
- Use paginated history for resume, fork, retry, and prompt-edit flows, while falling back to legacy history requests when the app server does not support pagination.
## Testing
- Cover multi-page transcript loading, page-boundary prompt reconciliation, legacy-server fallback, bounded retry history, and transcript history-state rendering.
GitOrigin-RevId: cc6b764bc4185d079b2f68bedf235c1d08278dfb
## Why
Paginated sessions can have visible messages beyond the first item page, so
bounded hydration could leave resumed history or transcript previews empty and
the transcript viewer incomplete.
## What changed
- Scan paginated history until the configured rendered-row budget is filled,
while retaining the configured scrollback beyond the visible viewport.
- Fully hydrate transcripts opened from the resume picker and build previews
from bounded item pages, including when non-visible items precede messages.
- Stop pagination on repeated cursors and let `Esc` cancel an in-flight
transcript load.
- Replay restored token usage for cold metadata-only resumes when its stored
turn can be identified.
## Testing
- Add coverage for paginated and legacy transcript loading, bounded resume
hydration, repeated cursors, transcript cancellation, and resize reflow.
GitOrigin-RevId: 2ce69f7d5eae88e2b09a27c333b00b1830ff17bf
## Why
Paginated threads should not require the TUI to load and render their entire
history when a session is resumed.
## What changed
- Hydrate a bounded initial history page for paginated resumes and forks,
respecting the configured terminal reflow row budget.
- Load older transcript items in the background as users navigate upward, while
preserving the viewport, live output, and backtrack selection.
- Reconcile review-mode prompts across page boundaries and keep restored token
usage hidden until it can be attributed to a persisted turn.
## Testing
- Added coverage for paginated resume and fork hydration, older-page merging,
transcript prepending, backtrack behavior, review prompt filtering, and token
usage restoration.
GitOrigin-RevId: 42160b943a9f6a1ba0cfe4b195c24ddf410b747d
## What changed
- Accept two-stroke bindings such as `ctrl-x ctrl-s` in TUI keymap configuration while preserving arrays as alternative bindings.
- Route chords through the active TUI context, show pending and configured chord hints, and cancel pending chords on `esc`, context changes, or a one-second timeout.
- Extend `/keymap` to capture, add, replace, and display key chords.
- Reject chords that conflict with active single-key bindings, overlapping-context chords, or reserved terminal shortcuts.
## Testing
- Add coverage for chord parsing, validation, matching, timeout and cancellation behavior, context dispatch, key capture, and rendered shortcut hints.
GitOrigin-RevId: dfdede03f518d4936ad8621ebf5537026f2b282e
## What changed
- Carry dimensions on resize events and reuse the cached screen size for ordinary draws.
- Refresh terminal geometry after resize settling, process resume, and external program execution.
- Pass the resolved size through transcript reflow, viewport updates, and standalone TUI screens so each frame uses consistent dimensions.
## Testing
- Cover cached draws, resize-driven rendering, settled-size rechecks, resume refreshes, and alternate-screen size updates.
GitOrigin-RevId: 9d83dbab50d7a038bd59b4c66c13abcac69ddc79
## Why
Refreshing the terminal palette on a focus event can block the input loop and
discard keystrokes entered while focus is returning.
## What changed
- Keep the palette cached by the startup probe when handling `FocusGained`.
- Continue updating focus state and requesting a redraw without issuing new
foreground or background color queries.
## Testing
- Verify a queued key is delivered after `FocusGained`.
- Exercise focus regain in a pseudo-terminal with immediate and delayed input,
and verify it emits no additional palette queries.
GitOrigin-RevId: 16e26f81c1343d01f6d0baeff3f204bcc91dd6f3
## What changed
- Guard `OtelProvider::shutdown` so exporters shut down at most once, including when an explicit shutdown is followed by `Drop`.
- Let tracer provider shutdown handle flushing without a separate `force_flush` call.
- Add regression tests for explicit shutdown and drop-only shutdown.
GitOrigin-RevId: f3c8769146ee57102477eb9ee7fd948f688efb79
## Why
When rebuilding a thread from rollout events, errors embedded in turn completion
events were ignored. Failed retries could therefore be restored as completed
turns, causing warnings such as model-overload errors to disappear from the TUI
transcript.
## What changed
- Mark turns with terminal completion errors as failed and retain their message
and structured error information.
- Apply late completion errors to their matching historical turn without
interrupting the active turn.
## Testing
Added history-builder coverage for current and late completion errors, plus a
TUI replay snapshot covering repeated overload failures.
GitOrigin-RevId: 5c474baa0fd5c73368b444d79fb850cbd4c8023a
## Why
Detached processor work can retain outgoing message senders, so waiting for
channel closure can keep the in-process app-server's outbound router alive
during shutdown.
## What changed
Add an explicit shutdown signal for the outbound router and prioritize it over
pending outgoing messages. Send that signal after processor tasks are stopped
so runtime shutdown no longer depends on every sender being dropped.
## Testing
Add a paused-time test that verifies the router exits and closes its channel
even when an outgoing sender is still retained.
GitOrigin-RevId: a8f88d88a0950f50339b1c56909fedb781f178d4
## What changed
- Stack action descriptions below their labels when the keymap action menu is too narrow for a readable description column.
- Keep descriptions column-aligned at wider terminal widths.
- Show a dash instead of a number beside the disabled remove-binding action.
## Testing
- Add snapshot coverage for the action menu at 48, 64, and 96 columns.
GitOrigin-RevId: 25b97fd2d8764563e0a0c36d436711f2429093c4
## Why
Reporting key event types can leak an exit-shortcut release into the parent
shell in iTerm2 and can cause tmux's `xterm` extended-key format to lose
Shift+Enter.
## What changed
- Select keyboard enhancement flags using the detected terminal and tmux
extended-key format.
- Disable event-type reporting for iTerm2 and tmux's `xterm` format while
retaining alternate-key reporting.
- Preserve event-type reporting for other terminals and tmux's `csi-u`
format so repeat events remain distinguishable.
## Testing
Added unit coverage for iTerm2, Kitty, unknown terminals, and both tmux
extended-key formats.
GitOrigin-RevId: 03a6b9d5443f626da5279413a14933af2a0ec3e5
## Why
An inherited `FILE_DELETE_CHILD` grant can make a write root look stale, but
`SET_ACCESS` cannot replace an ACE inherited from an ancestor. Treating that
grant as explicit causes unnecessary ACL refresh attempts that cannot converge.
## What changed
- Add explicit-ACE filtering to the Windows DACL permission checks.
- Refresh a write root only when `FILE_DELETE_CHILD` is present in an explicit
allow ACE, while retaining effective-permission checks for required rights.
- Ignore inherited stale rights when deciding whether `SET_ACCESS` must repair
an allow ACE.
## Testing
Add a Windows regression test covering a write root that inherits
`FILE_DELETE_CHILD`, verifying that repeated refresh checks leave its explicit
write ACE unchanged.
GitOrigin-RevId: d0df9429efcf299da3ff3c1bce92942684803293
## What changed
- Add one-shot composer and status-line transitions when the active reasoning effort changes to Max or Ultra.
- Keep a tier-specific prompt accent after the transition, including a distinct Ultra prompt glyph.
- Preserve drafts and footer priority, avoid replaying effects for restored or unchanged settings, and disable motion when animations or sufficient terminal color support are unavailable.
## Testing
- Add unit and snapshot coverage for animation frames, prompt accents, status-line transitions, narrow layouts, terminal palettes, restored sessions, and reduced-motion behavior.
GitOrigin-RevId: 6da1d501d228d0cf1144b3d211d5d1304a06f447
## Why
The thread inventory check compared state database rows only with plain
`.jsonl` rollout files. Once a rollout was compressed to `.jsonl.zst`, the
check could report its canonical database row as stale and omit the rollout
from parity results.
## What changed
- Scan completed compressed rollouts and match them to database rows using
their canonical `.jsonl` paths.
- Prefer a plain rollout when both plain and compressed siblings exist, and
ignore compression temporary files.
- Keep unreadable compressed rollouts in the set of existing paths so they
produce scan errors without also producing misleading stale-row reports.
- Use canonical paths when deriving legacy thread IDs and archived status.
## Testing
Added coverage for active and archived compressed rollouts, plain/compressed
siblings, metadata and legacy filename IDs, corrupt compressed data, and
compression temporary files.
GitOrigin-RevId: 2461376432194a4062beedbe875aa7002dd2049f
## Why
Assistant-authored inline visualizations need a terminal fallback that lets users open generated artifacts in a browser.
## What changed
- Recognize `::codex-inline-vis{file="..."}` directives in assistant Markdown and replace them with browser links during streaming, finalized history rendering, and local transcript previews.
- Materialize visualization fragments in sandboxed viewer documents with a content security policy, while restricting artifacts to HTML files within the thread's visualization directory and limiting their size.
- Show an explicit unavailable message for invalid or missing artifacts, hide incomplete streaming directives, and preserve directive text in code blocks and user Markdown.
- Add a trusted file-link path for generated viewers without enabling arbitrary `file:` links in Markdown.
## Testing
Add coverage for directive rewriting, streaming and replay, artifact validation, sandboxed viewer generation, trusted terminal hyperlinks, and literal preservation.
GitOrigin-RevId: a666b4ebc82bb5798ad45bd137fd815d538e1de2
## Why
Multi-agent V2 spawned threads are controlled by their parent and reject direct
app-server input. The TUI should expose that ownership instead of presenting an
input flow that the server will reject.
## What changed
- Add the experimental `Thread.canAcceptDirectInput` capability for loaded
threads and populate it from the same policy used to validate `turn/start`
and `turn/steer`. Stored, unloaded threads report `null`.
- Carry the capability through TUI thread discovery, selection, startup, and
resume flows, with a compatibility fallback for older app servers.
- Present parent-owned threads as view-only, preserve drafts and queued input,
block agent-directed commands and settings shortcuts, and keep local
navigation and inspection commands available.
## Testing
- Cover V1 writable and V2 view-only spawned threads through selection and
resume.
- Cover composer submission paths, queued and initial input preservation,
allowed navigation commands, settings shortcuts, and the view-only UI.
GitOrigin-RevId: 495ad051249e5577fb0b0c1cc8c40a0998d04918
## What changed
- Add experimental `beforeTurnId` support to `thread/fork` for copying history strictly before a turn, including an in-progress turn.
- Use before-turn forks for TUI backtracking and safety retries so the replacement prompt retains thread context instead of recreating the branch from the preceding turn or a new thread.
- Add experimental `deferGoalContinuation` support so safety-retry forks can inherit an active goal while waiting for the replacement turn before automatic continuation resumes.
- Hide duplicated nested-review prompts when replaying history or selecting a prompt to edit.
## Testing
- Cover before-turn truncation, fork validation, active-goal inheritance, TUI safety retries, backtracking, and nested-review replay.
GitOrigin-RevId: 4915d85ae1929a0b8c40f3ed7dca29c7a5bdcdf3
## Why
Retrying a safety-buffered turn by rolling back the active thread rewrites the
source conversation and requires the TUI to repair its local transcript state.
## What changed
- Interrupt the buffered turn, then fork after the preceding completed turn and
submit the prompt on the new thread with the faster model and low reasoning
effort.
- Start a new thread when the buffered request is the conversation's first turn.
- Preserve committed steering input in the retry, leave the source thread
intact, and restore the prompt alongside any existing draft if branching
fails.
- Do not offer the retry action for side conversations or stale and in-progress
turns.
## Testing
Added coverage for retries with prior context, first-turn retries, committed
steering input, branch failures, existing composer drafts and attachments, and
side conversations.
GitOrigin-RevId: adb49da8236e9212ef0082e033e6f715986b5cd9
## What changed
- Add an explicit restore mode for thread input snapshots and use it when replaying thread snapshots.
- Preserve the pending-steer interrupt flag alongside running-turn and queued-input state when restoring an in-flight turn.
- When in-flight state is not preserved, clear stale running flags and move pending steers ahead of already queued follow-ups while retaining their history records.
## Testing
- Expand TUI tests to cover both restoration modes, including sleep-inhibitor state, pending-steer ordering, history records, and queued submission.
GitOrigin-RevId: f4e8b2bdf065ef6c6644b7f0ea9cf32c8a9af619
## What changed
- Fork the conversation immediately before the selected prompt instead of rolling back the current thread in place, preserving the original conversation.
- Reopen the selected prompt in the new conversation with its images, text elements, and mention bindings intact.
- Start a fresh conversation when editing the first prompt, show a dedicated continuation notice, and restore the prompt with an error if branching fails.
## Testing
- Cover branching before first and later prompts, source preservation, prompt restoration, hidden review prompts, mid-turn steering, in-progress turns, stale transcript entries, and mention bindings.
GitOrigin-RevId: 15473535b3f9733b0300711a498969e6d389db79
## What changed
- Leave an output-free interrupted prompt in the transcript and open a blank
composer for the user's next instruction.
- Use the normal interruption notice for both `Esc` and `Ctrl-C` interrupts.
- Track safety-buffering prompts separately so failed retries can still restore
the prompt, including after switching between threads.
## Testing
- Cover output-free `Esc` and `Ctrl-C` interrupts, failed safety-buffer retries,
and restoration of safety-buffer state from thread snapshots.
GitOrigin-RevId: 30b368d00dfdb981d06d4c95ce3f252389b7917c
## Why
`Max` and `Ultra` consume usage limits faster than standard reasoning levels, so they should not be selected accidentally while navigating the normal effort scale.
## What changed
- Move `Max` and `Ultra` behind a `More reasoning…` entry with a dedicated warning and descriptions.
- Keep the reasoning shortcuts from silently increasing into advanced efforts.
- Apply `Ultra` to the active conversation without changing defaults for new threads, while preserving it across mode switches and thread resumes.
- Record applied thread settings in thread metadata, including explicit clearing of reasoning effort, so resumed threads restore their latest model settings unless the user supplied an override.
## Testing
- Add TUI coverage for the advanced picker, shortcuts, Plan mode, configuration defaults, and resumed conversations.
- Add app-server and thread-store coverage for persisting, clearing, and restoring model and reasoning settings.
GitOrigin-RevId: 6708c7c2e8d38f491bf63000ea34f83476afdfe6
## Why
The skill toggle view truncated every display name to 21 characters, even when
the popup had enough room to show more. This could hide the part that
distinguishes similarly named skills.
## What changed
- Pass full skill display names to the shared row renderer so it can fit them
to the available width alongside descriptions.
- Keep narrow layouts bounded by the renderer's width-aware truncation.
## Testing
Added coverage for preserving and filtering full display names, plus snapshots
for wide and narrow popup layouts.
GitOrigin-RevId: c434237e00440f920d8aa9c365b6bda5e68e0941
## What changed
- Replace tab characters in rendered diff spans with four spaces while keeping
their wrapping width and style intact.
- Ensure diff buffers never contain literal tab characters.
## Testing
- Cover tab expansion and wrapping in `wrap_styled_spans`.
- Update diff gallery snapshots at multiple terminal sizes.
GitOrigin-RevId: 2159e84991b844ea8c4c57dfad52bc3fe7a9059f
## What changed
- Add `supports_reasoning_summary_parameter` to model metadata, defaulting to
`true` for backward compatibility.
- Omit `reasoning.summary` and its summary-delivery stream option when the
selected model does not support the parameter.
- Apply the capability of the final selected model when a spawned agent uses a
different model.
## Testing
- Cover unsupported models in regular requests and spawned-agent model
overrides.
GitOrigin-RevId: 72b783799fc0685cef1501ef2dbf62d1308ceead
Felipe Coury